#!/bin/bash
#
# Varnish HTTPS诊断脚本
# 用于排查Hitch服务启动失败的问题
#

# 颜色输出
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

DOMAIN="ws.waterism.tech"
HTTPS_PORT="6443"
VARNISH_PORT="6081"
HITCH_CERT="/etc/hitch/certs/$DOMAIN.pem"

echo -e "${GREEN}======================================${NC}"
echo -e "${GREEN}Varnish HTTPS诊断脚本${NC}"
echo -e "${GREEN}======================================${NC}"
echo ""

# 1. 检查Hitch配置文件
echo -e "${GREEN}[1] 检查Hitch配置文件${NC}"
if [ -f /etc/hitch/hitch.conf ]; then
    echo -e "${GREEN}✓ 配置文件存在: /etc/hitch/hitch.conf${NC}"
    echo ""
    echo "配置内容:"
    cat /etc/hitch/hitch.conf
    echo ""
else
    echo -e "${RED}✗ 配置文件不存在: /etc/hitch/hitch.conf${NC}"
fi
echo ""

# 2. 检查证书文件
echo -e "${GREEN}[2] 检查SSL证书${NC}"
if [ -f "$HITCH_CERT" ]; then
    echo -e "${GREEN}✓ 证书文件存在: $HITCH_CERT${NC}"
    
    # 检查证书权限
    ls -l "$HITCH_CERT"
    
    # 检查证书内容
    echo ""
    echo "证书信息:"
    openssl x509 -in "$HITCH_CERT" -noout -subject -dates 2>/dev/null || echo "证书格式可能有问题"
    
    # 验证证书文件格式
    echo ""
    echo "验证证书文件格式:"
    if openssl x509 -in "$HITCH_CERT" -noout 2>/dev/null; then
        echo -e "${GREEN}✓ 证书格式正确${NC}"
    else
        echo -e "${RED}✗ 证书格式错误${NC}"
    fi
    
    if openssl rsa -in "$HITCH_CERT" -check -noout 2>/dev/null; then
        echo -e "${GREEN}✓ 私钥格式正确${NC}"
    else
        echo -e "${RED}✗ 私钥格式错误${NC}"
    fi
else
    echo -e "${RED}✗ 证书文件不存在: $HITCH_CERT${NC}"
fi
echo ""

# 3. 检查端口占用
echo -e "${GREEN}[3] 检查端口占用${NC}"
echo "检查Varnish端口 $VARNISH_PORT:"
if netstat -tlnp 2>/dev/null | grep ":$VARNISH_PORT" || ss -tlnp 2>/dev/null | grep ":$VARNISH_PORT"; then
    echo -e "${GREEN}✓ Varnish正在监听端口 $VARNISH_PORT${NC}"
else
    echo -e "${RED}✗ Varnish未在端口 $VARNISH_PORT 上监听${NC}"
    echo -e "${YELLOW}需要先启动Varnish服务${NC}"
fi
echo ""

echo "检查HTTPS端口 $HTTPS_PORT:"
if netstat -tlnp 2>/dev/null | grep ":$HTTPS_PORT" || ss -tlnp 2>/dev/null | grep ":$HTTPS_PORT"; then
    echo -e "${YELLOW}⚠ 端口 $HTTPS_PORT 已被占用${NC}"
    netstat -tlnp 2>/dev/null | grep ":$HTTPS_PORT" || ss -tlnp 2>/dev/null | grep ":$HTTPS_PORT"
else
    echo -e "${GREEN}✓ 端口 $HTTPS_PORT 可用${NC}"
fi
echo ""

# 4. 检查Hitch用户
echo -e "${GREEN}[4] 检查Hitch用户${NC}"
if id "hitch" &>/dev/null; then
    echo -e "${GREEN}✓ hitch用户存在${NC}"
    id hitch
else
    echo -e "${YELLOW}⚠ hitch用户不存在（Ubuntu可能不创建）${NC}"
    echo "证书文件应该使用root权限"
fi
echo ""

# 5. 查看Hitch日志
echo -e "${GREEN}[5] 查看Hitch服务日志${NC}"
if command -v journalctl &>/dev/null; then
    journalctl -u hitch -n 30 --no-pager
else
    echo -e "${YELLOW}journalctl命令不可用${NC}"
    
    # 尝试其他日志
    if [ -f /var/log/syslog ]; then
        echo "查看syslog中的Hitch日志:"
        tail -n 30 /var/log/syslog | grep -i hitch
    elif [ -f /var/log/messages ]; then
        echo "查看messages中的Hitch日志:"
        tail -n 30 /var/log/messages | grep -i hitch
    fi
fi
echo ""

# 6. 检查Varnish服务
echo -e "${GREEN}[6] 检查Varnish服务状态${NC}"
if systemctl is-active --quiet varnish; then
    echo -e "${GREEN}✓ Varnish服务运行正常${NC}"
    systemctl status varnish --no-pager | head -n 10
else
    echo -e "${RED}✗ Varnish服务未运行${NC}"
    echo "请先启动Varnish: systemctl start varnish"
fi
echo ""

# 7. 尝试手动启动Hitch测试
echo -e "${GREEN}[7] 尝试手动启动Hitch进行测试${NC}"
echo "执行命令: hitch --config=/etc/hitch/hitch.conf --test"
echo ""
hitch --config=/etc/hitch/hitch.conf --test 2>&1
HITCH_TEST_EXIT=$?
echo ""

if [ $HITCH_TEST_EXIT -eq 0 ]; then
    echo -e "${GREEN}✓ Hitch配置测试通过${NC}"
else
    echo -e "${RED}✗ Hitch配置测试失败 (退出码: $HITCH_TEST_EXIT)${NC}"
fi
echo ""

# 8. 建议修复方案
echo -e "${GREEN}======================================${NC}"
echo -e "${GREEN}建议的修复方案${NC}"
echo -e "${GREEN}======================================${NC}"
echo ""

if [ $HITCH_TEST_EXIT -ne 0 ]; then
    echo "根据测试结果，可能的问题和解决方案："
    echo ""
    echo "1. 如果提示证书文件问题:"
    echo "   # 重新生成证书文件"
    echo "   sudo cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem \\"
    echo "            /etc/letsencrypt/live/$DOMAIN/privkey.pem \\"
    echo "            > $HITCH_CERT"
    echo "   sudo chmod 600 $HITCH_CERT"
    echo ""
    echo "2. 如果提示权限问题:"
    echo "   sudo chown root:root $HITCH_CERT"
    echo "   sudo chmod 600 $HITCH_CERT"
    echo ""
    echo "3. 如果提示配置语法错误:"
    echo "   检查 /etc/hitch/hitch.conf 配置文件"
    echo ""
    echo "4. 如果后端Varnish未运行:"
    echo "   sudo systemctl start varnish"
    echo "   sudo systemctl status varnish"
    echo ""
fi

echo "完成诊断后，可以尝试重新启动Hitch:"
echo "  sudo systemctl restart hitch"
echo "  sudo systemctl status hitch"
echo ""

